feat: add badge system

src/app/api/admin/events/image/route.ts → src/app/api/admin/badges/image/route.ts

@@ -1,7 +1,8 @@
 import { NextRequest, NextResponse } from "next/server";
-import { EventService } from "@/services/event-service";
-import { isAllowedAdminAddress } from "@/lib/admin-auth";
 import { verifyMessage } from "viem";
+import { isAllowedAdminAddress } from "@/lib/admin-auth";
+import BadgesService from "@/services/badges/badges-service";
+import { getSupabaseAdmin } from "@/services/supabase-admin";
 
 async function verifyAdminAuth(req: NextRequest) {
   const address = req.headers.get("x-admin-address")?.toLowerCase();
@@ -26,30 +27,44 @@ async function verifyAdminAuth(req: NextRequest) {
   }
 }
 
+// POST - upload a badge image, returning the public URL to save as imageurl
 export async function POST(req: NextRequest) {
   const isAuth = await verifyAdminAuth(req);
   if (!isAuth)
     return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
 
   try {
     const formData = await req.formData();
-    const file = formData.get("image") as File | null;
+    const file = formData.get("image");
 
-    if (!file) {
+    if (!(file instanceof File)) {
       return NextResponse.json(
         { error: "Missing image file" },
         { status: 400 },
       );
     }
 
-    const uploaded = await EventService.uploadEventImage(file);
+    // Unlike the events bucket, the badges bucket has no MIME restriction of
+    // its own, so this is the only thing keeping non-images out of it.
+    if (!file.type.startsWith("image/")) {
+      return NextResponse.json(
+        { error: "Badge image must be an image file" },
+        { status: 400 },
+      );
+    }
+
+    const uploaded = await new BadgesService(
+      getSupabaseAdmin(),
+    ).uploadBadgeImage(file);
+
     return NextResponse.json({
-      event_path: uploaded.imagePath,
-      event_url: uploaded.imageUrl,
+      image_path: uploaded.imagePath,
+      imageurl: uploaded.imageUrl,
     });
-  } catch (err: any) {
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err);
     return NextResponse.json(
-      { error: err.message || "Image upload failed" },
+      { error: message || "Image upload failed" },
       { status: 500 },
     );
   }

src/app/api/admin/badges/route.ts

@@ -0,0 +1,70 @@
+import { NextRequest, NextResponse } from "next/server";
+import { verifyMessage } from "viem";
+import { z } from "zod";
+import { isAllowedAdminAddress } from "@/lib/admin-auth";
+import BadgesService from "@/services/badges/badges-service";
+import { getSupabaseAdmin } from "@/services/supabase-admin";
+
+// Postgres errors caused by the request's data rather than the server:
+// foreign key (e.g. an eventid with no matching event) and check constraints.
+const CLIENT_ERROR_CODES = new Set(["23503", "23514"]);
+
+async function verifyAdminAuth(req: NextRequest) {
+  const address = req.headers.get("x-admin-address")?.toLowerCase();
+  const signature = req.headers.get("x-admin-signature");
+  const timestamp = req.headers.get("x-admin-timestamp");
+
+  if (!address || !signature || !timestamp || !isAllowedAdminAddress(address))
+    return false;
+
+  const now = Date.now();
+  if (now - parseInt(timestamp) > 5 * 60 * 1000) return false;
+
+  try {
+    const valid = await verifyMessage({
+      address: address as `0x${string}`,
+      message: `Admin Auth ${timestamp}`,
+      signature: signature as `0x${string}`,
+    });
+    return valid;
+  } catch {
+    return false;
+  }
+}
+
+// POST - create a badge. The body is validated by badgeInsertSchema, which
+// also enforces that an EVENT badge carries an eventid.
+export async function POST(req: NextRequest) {
+  const isAuth = await verifyAdminAuth(req);
+  if (!isAuth)
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+
+  try {
+    const body = await req.json().catch(() => null);
+    if (!body || typeof body !== "object") {
+      return NextResponse.json(
+        { error: "Request body must be a JSON object" },
+        { status: 400 },
+      );
+    }
+
+    const badge = await new BadgesService(getSupabaseAdmin()).createBadge(body);
+    return NextResponse.json({ badge });
+  } catch (err: unknown) {
+    if (err instanceof z.ZodError) {
+      return NextResponse.json(
+        { error: err.issues.map((issue) => issue.message).join("; ") },
+        { status: 400 },
+      );
+    }
+
+    const code = (err as { code?: string } | null)?.code;
+    const message =
+      (err as { message?: string } | null)?.message || "Failed to create badge";
+
+    return NextResponse.json(
+      { error: message },
+      { status: code && CLIENT_ERROR_CODES.has(code) ? 400 : 500 },
+    );
+  }
+}